defi · advanced

Flash Loan Attacks and Arbitrage

Flash loan arbitrage uses DeFi flash loans to borrow capital, trade across markets, repay the loan, and keep any remaining profit in one blockchain transaction. The same mechanism can also power flash loan attacks when weak pricing, oracle design, or liquidity rules are abused.

In this lesson, you will learn how <strong>DeFi flash loans</strong> work, why traders use them for <strong>flash loan arbitrage</strong>, and how the same tools can be used in <strong>flash loan attacks</strong>. You will also learn practical risk checks that advanced traders should understand before interacting with protocols, liquidity pools, or arbitrage bots.

1. What a Flash Loan Is

A <strong>flash loan</strong> is an uncollateralized loan that must be borrowed and repaid inside one blockchain transaction. <strong>Uncollateralized</strong> means the borrower does not deposit assets as security. This is possible because of <strong>atomic execution</strong>, which means the whole transaction either succeeds completely or fails completely.

If the borrower repays the loan plus the required fee before the transaction ends, the transaction is valid. If not, the blockchain reverses the whole transaction as if it never happened.

A basic flash loan flow looks like this:

  • Borrow 1,000,000 USDC from a lending protocol.
  • Use it to trade, refinance, liquidate, or arbitrage.
  • Repay 1,000,000 USDC plus the flash loan fee.
  • Keep any leftover profit.

    • This design is powerful because it gives traders temporary access to large capital. It also compresses all risk into one transaction. There is no long-term debt, no margin call, and no open loan position after the block is confirmed.

    However, this does not mean flash loans are risk-free. Traders still face:

  • <strong>Gas costs</strong>, which are transaction fees paid to validators.
  • <strong>Slippage</strong>, which is the price movement caused by the trade itself.
  • <strong>Protocol fees</strong>, including swap and flash loan fees.
  • <strong>Failed transaction costs</strong>, because gas may still be paid even if the trade fails.
  • <strong>Smart contract risk</strong>, which is the risk that code behaves unexpectedly or contains a bug.

    • Flash loans are not magic money. They are a tool for executing a pre-planned strategy very quickly.

    2. Flash Loan Arbitrage in Practice

    <strong>Arbitrage</strong> means buying an asset cheaper in one market and selling it higher in another market. <strong>Flash loan arbitrage</strong> uses borrowed funds from a flash loan to capture that price difference without needing to hold the capital upfront.

    Example:

  • ETH trades at 2,000 USDC on DEX A.
  • ETH trades at 2,020 USDC on DEX B.
  • A trader borrows 1,000,000 USDC using a flash loan.
  • The trader buys ETH on DEX A.
  • The trader sells ETH on DEX B.
  • The trader repays the loan and fee.
  • Any remaining USDC is profit.

    • A <strong>DEX</strong>, or decentralized exchange, is an on-chain platform where users trade directly through smart contracts. Many DEXs use an <strong>AMM</strong>, or automated market maker. An AMM prices assets using liquidity pools instead of a traditional order book.

    In real trading, the simple example above is much harder. A profitable arbitrage must cover every cost:

  • Flash loan fee.
  • Swap fees on both exchanges.
  • Gas fees.
  • Slippage on both trades.
  • Price movement before the transaction is included in a block.
  • MEV competition.

    • <strong>MEV</strong>, or maximum extractable value, is the profit that block builders, validators, or bots can extract by ordering transactions in a certain way. If your arbitrage is visible in the public mempool, another bot may copy it, outbid your gas fee, and take the opportunity first. This is called being <strong>front-run</strong>, which means another transaction is placed before yours.

    Practical trader example:

    A trader scans several DEX pools and finds a small price gap between USDC/ETH pools. The raw spread is 0.45%. After modeling fees and slippage, the net spread is only 0.06%. If gas is high, the trade may become unprofitable. If liquidity is thin, the trade may move the pool price too much. The trader should execute only if the estimated profit remains positive after a safety buffer.

    For traders who also compare centralized exchange prices, a platform such as [CoinW](https://www.coinw.com/en_US/register?r=3443555) can be one reference point, but flash loan execution itself happens on-chain and must settle within one transaction.

    3. How Flash Loan Attacks Happen

    <strong>Flash loan attacks</strong> happen when someone uses a flash loan to manipulate a weak part of a DeFi protocol and extract value. The flash loan is not the vulnerability by itself. It is the source of temporary capital that makes the exploit large enough to matter.

    Common attack patterns include:

  • <strong>Oracle manipulation</strong>: An oracle is a data source that tells a protocol the price of an asset. If a protocol uses a single low-liquidity DEX pool as its price oracle, an attacker can move that pool price with a large flash loan trade, borrow against the fake price, and leave the protocol with bad debt.
  • <strong>Liquidity pool manipulation</strong>: A large temporary trade can distort an AMM pool price. If another protocol trusts that price immediately, it may make incorrect lending, borrowing, or liquidation decisions.
  • <strong>Governance manipulation</strong>: Governance is the process of voting on protocol changes. If voting power can be borrowed temporarily, an attacker may pass a harmful proposal in one transaction or short voting window.
  • <strong>Reentrancy or logic bugs</strong>: Reentrancy is when a smart contract is called again before the first call finishes. Flash loans can provide the capital needed to trigger and scale these bugs.

    • Example of oracle manipulation:

  • A lending protocol lets users borrow stablecoins against Token X.
  • The protocol values Token X using only one DEX pool.
  • An attacker borrows a large amount with a flash loan.
  • The attacker buys Token X heavily, pushing its DEX price up for one block.
  • The protocol reads the inflated price.
  • The attacker deposits Token X as collateral and borrows too many stablecoins.
  • The attacker repays the flash loan and keeps the excess borrowed assets.
  • The protocol is left with undercollateralized debt.

    • The key lesson is that protocols should not trust prices that can be moved cheaply within a single transaction.

    4. Risk Management for Traders and Protocol Users

    Advanced traders should analyze flash loan opportunities and protocol risks with the same discipline used in professional trading.

    Before running or copying a flash loan arbitrage strategy, check:

  • <strong>Net profit after all fees</strong>: Include loan fee, DEX fees, gas, priority fees, and expected slippage.
  • <strong>Liquidity depth</strong>: A large trade in a small pool can erase the entire spread.
  • <strong>Execution path</strong>: More swaps mean more fees, more slippage, and more smart contract risk.
  • <strong>Mempool exposure</strong>: Public transactions may be copied or front-run by MEV bots.
  • <strong>Failure behavior</strong>: Understand what happens if one leg of the trade fails.
  • <strong>Contract permissions</strong>: Avoid giving unlimited token approvals to unknown contracts.

    • When evaluating a DeFi protocol as a user, check whether it has defenses against flash loan attacks:

  • Uses <strong>time-weighted average price</strong>, or TWAP, which averages prices over time instead of trusting one block.
  • Uses multiple independent oracles, not just one thin liquidity pool.
  • Has audited smart contracts and public audit reports.
  • Limits sudden borrowing, withdrawals, or governance changes.
  • Uses circuit breakers, which pause risky actions when prices move too far too fast.
  • Has a bug bounty, which rewards researchers for reporting vulnerabilities.

    • A practical red flag is a lending protocol that lists a volatile token as collateral and prices it from one small AMM pool. If the pool has low liquidity, a flash loan can move the price sharply. That does not guarantee an attack will happen, but it means the risk is higher.

    For arbitrage traders, the most important habit is to simulate before execution. A <strong>simulation</strong> is a test run against current blockchain state that estimates whether a transaction will succeed. Many professional bots simulate every trade and reject it unless the result clears a minimum profit threshold.

    5. Defensive Design and Ethical Boundaries

    Flash loans are neutral technology. They support useful actions such as arbitrage, liquidations, collatera

    Interactive lesson at /learn/lesson/flash-loan-attacks-and-arbitrage